CVE-2024-4198

Name of the Vulnerable Software and Affected Versions Mattermost versions 8.1.x through 8.1.11 Mattermost versions 9.5.x through 9.5.2 Mattermost version 9.6.0

Description The issue arises from the failure to fully validate role changes, allowing an attacker authenticated as a team admin to demote users to guest via crafted HTTP requests.

Recommendations For Mattermost versions 8.1.x through 8.1.11, update to version 8.1.12 or later. For Mattermost versions 9.5.x through 9.5.2, update to version 9.5.3 or later. For Mattermost version 9.6.0, consider disabling role change functionality until a patch is available.